linux-kernel - Re: [Regression] 2.6.38 ncpfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <201104142217.12478.bonganilinux@mweb.co.za>
Date:	Thu, 14 Apr 2011 22:17:12 +0200
From:	Bongani Hlope <bonganilinux@...b.co.za>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	npiggin@...nel.dk, "Rafael J. Wysocki" <rjw@...k.pl>,
	linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
	Greg KH <greg@...ah.com>,
	"Dr. Bernd Feige" <bernd.feige@...klinik-freiburg.de>,
	Petr Vandrovec <petr@...drovec.name>,
	Arnd Bergmann <arnd@...db.de>, Christoph Hellwig <hch@....de>
Subject: Re: [Regression] 2.6.38 ncpfs

On Thursday 14 April 2011 19:29:34 Linus Torvalds wrote:
> On Thu, Apr 14, 2011 at 10:14 AM, Bongani Hlope <bonganilinux@...b.co.za> 
wrote:
> > The bug is caused by commit fb2d5b86aff355a27ebfc132d3c99f4a940cc3fe,
> > which was committed by Nick. Can you please either revert Nick's changes
> > or include the attached patch (or a better version, because I'm not that
> > clued up with ncpfs).
> 
> Hmm. Your patch isn't correct. You can't just do
> 
>    if (!mutex_is_locked(&dentry->d_inode->i_mutex)) {
>       mutex_lock(&inode->i_mutex);
> 
> because code like that makes no sense - maybe it was locked by
> somebody _else_, and you would need to lock it.
> 
> That said, I do think that the
> 
>   BUG_ON(!mutex_is_locked(&dentry->d_inode->i_mutex));
> 
> is wrong, since even the comment above it talks about the _parent_
> dentry, not the dentry that is actually being modified.
> 
> So there's clearly a bug somewhere, and the fix may be to just remove
> that BUG_ON().
> 
> Added some more people to the cc.
> 
>                                    Linus

Looking at the changes,  you are right. The BUG_ON() seems to be what is not 
suppose to be there. The attached patch only removes the BUG_ON(). I'll test 
on my work PC tomorrow and see if that also fixes the bug.

The previous code was:

               if (qname.len == newdent->d_name.len &&
                   memcmp(newdent->d_name.name, qname.name, newdent-
>d_name.len)) {
8<
                        */
                       if (inode)
                               mutex_lock(&inode->i_mutex);
                       spin_lock(&dcache_lock);
                       spin_lock(&newdent->d_lock);
                       memcpy((char *) newdent->d_name.name, qname.name,
                                                               newdent-
>d_name.len);
                       spin_unlock(&newdent->d_lock);
                       spin_unlock(&dcache_lock);
                       if (inode)
                               mutex_unlock(&inode->i_mutex);
               }

and it was replaced by:

       BUG_ON(!mutex_is_locked(&dentry->d_inode->i_mutex));
       BUG_ON(dentry->d_name.len != name->len); /* d_lookup gives this */

       spin_lock(&dcache_lock);
       spin_lock(&dentry->d_lock);
       memcpy((unsigned char *)dentry->d_name.name, name->name, name->len);
       spin_unlock(&dentry->d_lock);
       spin_unlock(&dcache_lock);

View attachment "ncpfs.patch" of type "text/x-patch" (389 bytes)